Extracted

• • Target
    3a4d74da9a2555a2a36f51165b4e502673a142a75d2f6e8dafd8e45593e30124
  • Size 45KB
  • SHA256 3a4d74da9a2555a2a36f51165b4e502673a142a75d2f6e8dafd8e45593e30124
  • MD5 d6b529ced0e2b1bfcf057767cfb8186f
  • SHA1 ecccf61f09a23fbd0ef2d73ac45c9f91cad238b0
  • SHA512 f16036a87edef070354290d12b4b467bb86fbe91b67a04fb35a84dfec410ae1a74a7b0116d5d70a824dbeee14cf51df9d8854231242c8954f2f41e5006d8d009
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFB3XodEayPIPzjbQgX3iHla0DZCo6oBDZEx:MuLAZTnbg2uUEabP3bXXSFJDZCqdEx
  • TLSH
    T1C2231B003BE8822BF2BE4F78ADF25145867AF5A36603D5492CC441DB5713FC69A429FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2